# New logstash installation is not working
**URL:** https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824
**Category:** Logstash
**Created:** [July 5, 2025, 2:28am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824 "2025-07-05T02:28:40Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Luis\_Moy](https://discuss.elastic.co/u/Luis_Moy)
#### Post date: [July 5, 2025, 2:28am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/1 "2025-07-05T02:28:40Z")
Hello I want to install logstash in red hat linux 9. according with this documentation, because i need this specific version.
> **[How to write a Java filter plugin | Logstash Reference \[7.16\] | Elastic](https://www.elastic.co/guide/en/logstash/7.16/java-filter-plugin.html)**
I followed the instructions.
downloaded from the github the version, and using jdk 11 from oracle.
I used this environment variables
MY\_RUBY\_HOME=/home/admin/jruby-9.4.13.0
LOGSTASH\_CORE=/home/admin/logstash/logstash/logstash-core
LOGSTASH\_CORE\_PATH=/home/admin/logstash/logstash/logstash-core
GEM\_PATH=/home/admin/jruby-9.4.13.0/gems
GEM\_HOME=/home/admin/jruby-9.4.13.0/gems
LS\_HOME=/home/admin/logstash/logstash
I downloaded the plugin source code and generated gem, but when i try to upload to logstash
logstash-plugin install --no-verify --local ./logstash-filter-java\_filter\_example-1.0.3.gem
[root@rh9v logstash-filter-java\_filter\_example]# logstash-plugin install --no-verify --local ./logstash-filter-java\_filter\_example-1.0.3.gem
Using system java: /bin/java
Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
**LoadError: no such file to load -- clamp**
\*\* require at org/jruby/RubyKernel.java:974\*\*
\*\* require at\*\* /home/admin/logstash/logstash/vendor/jruby/lib/ruby/stdlib/rubygems/core\_ext/kernel\_require.rb:83
at /home/admin/logstash/logstash/lib/pluginmanager/main.rb:30 [root@rh9v logstash-filter-java\_filter\_example]#
I had this error, and i dont know why this error,
if i use
gem list
[root@rh9v logstash-filter-java\_filter\_example]# gem list
\*\*\* LOCAL GEMS \*\*\*
abbrev (default: 0.1.0)
base64 (default: 0.1.1)
benchmark (default: 0.2.0)
bigdecimal (default: 3.1.4 java)
bundler (default: 2.6.3)
cgi (default: 0.3.6 java)
clam (0.0.1)
csv (default: 3.2.5)
date (default: 3.3.3 java)
debug (default: 0.2.1)
delegate (default: 0.2.0)
did\_you\_mean (default: 1.6.1)
digest (default: 3.1.0 java)
drb (default: 2.1.0)
english (default: 0.7.1)
erb (default: 2.2.3)
error\_highlight (default: 0.3.0)
ffi (default: 1.16.3 java)
ffi-binary-libfixposix (default: 0.5.1.1 java)
ffi-bindings-libfixposix (default: 0.5.1.0)
fiddle (default: 1.1.4)
fileutils (default: 1.6.0)
find (default: 0.1.1)
forwardable (default: 1.3.2)
getoptlong (default: 0.1.1)
io-console (default: 0.7.2 java)
io-wait (default: 0.3.0 java)
ipaddr (default: 1.2.4)
irb (default: 1.4.2)
jar-dependencies (default: 0.5.4)
jruby-openssl (default: 0.15.4 java)
jruby-readline (default: 1.3.7 java)
json (default: 2.7.1 java)
logger (default: 1.5.1)
mutex\_m (default: 0.1.1)
net-http (default: 0.3.0)
net-protocol (default: 0.1.2)
nkf (default: 0.2.0 java)
observer (default: 0.1.1)
open-uri (default: 0.3.0)
open3 (default: 0.1.2)
optparse (default: 0.2.0)
ostruct (default: 0.5.5)
pp (default: 0.3.0)
prettyprint (default: 0.1.1)
pstore (default: 0.1.1)
psych (default: 5.2.3 java)
racc (default: 1.6.0 java)
rake-ant (default: 1.0.6)
rdoc (default: 6.4.1.1)
reline (default: 0.5.12)
resolv-replace (default: 0.1.0)
rinda (default: 0.1.1)
ruby2\_keywords (default: 0.0.5)
rubygems-update (default: 3.6.3)
securerandom (default: 0.2.0)
shellwords (default: 0.1.0)
singleton (default: 0.1.1)
stringio (default: 3.1.5 java)
strscan (default: 3.1.0 java)
subspawn (default: 0.1.1)
subspawn-posix (default: 0.1.1)
time (default: 0.2.2)
timeout (default: 0.3.2)
tsort (default: 0.1.0)
un (default: 0.2.0)
uri (default: 0.12.3)
weakref (default: 0.1.1)
yaml (default: 0.2.0)
[root@rh9v logstash-filter-java\_filter\_example]#
---
### Author:  [@HarimbolaSantatra](https://discuss.elastic.co/u/HarimbolaSantatra)
#### Post date: [July 5, 2025, 8:57am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/2 "2025-07-05T08:57:53Z")
> [@Luis\_Moy](#):
>
> Hello I want to install logstash in red hat linux 9. according with this documentation, because i need this specific version.
The link you provided is not the installation documentation. Here is the correct one:
> **[Installing Logstash | Logstash](https://www.elastic.co/docs/reference/logstash/installing-logstash)**
>
> The Logstash binaries are available from https://www.elastic.co/downloads. Download the Logstash installation file for your host environment—TAR.GZ, DEB,...
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 5, 2025, 1:39pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/3 "2025-07-05T13:39:13Z")
Your issue is not about installing Logstash, is about building a custom plugin.
What is the Logstash version you are using? You didn't specify, please provide exact Logstash version you are using to check if you are using the correct documentation.
---
### Author:  [@Luis\_Moy](https://discuss.elastic.co/u/Luis_Moy)
#### Post date: [July 5, 2025, 3:18pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/4 "2025-07-05T15:18:27Z")
hello im using version 7.1
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [July 5, 2025, 4:01pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/5 "2025-07-05T16:01:37Z")
Please check
> **[Support Matrix](https://www.elastic.co/support/matrix)**
>
> The tables below display platform and software configurations that are eligible for support under our
> subscription offerings. Learn more about our
> Support Policy and product End of Life poli...
It might not the reason your plugin build is failing, but note that Logstash 7.1.x is not supported on RHEL 9, nor RHEL 8 as it happens. By my reading, 8.4.x is first release to support RHEL 9.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 5, 2025, 4:15pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/6 "2025-07-05T16:15:57Z")
> [@Luis\_Moy](#):
>
> hello im using version 7.1
Yeah, couple of issues here, if you are on version 7.1 you need to check the documentation of this specific version, you shared a documentation for 7.16, you need to check the steps on the documentation for 7.1 as they may be different, you can find it [here](https://www.elastic.co/guide/en/logstash/7.1/java-filter-plugin.html).
Another issue is version 7 is not supported anymore and it was never supported on RHEL 9, so you are testing both an unsupported version on an unsupported system for that version.
Any issue you have you would need to replicated on supported versions on supported systems.
Is pretty complicated to troubleshoot things that are that old and not supported.
---
### Author:  [@Luis\_Moy](https://discuss.elastic.co/u/Luis_Moy)
#### Post date: [July 6, 2025, 3:42am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/7 "2025-07-06T03:42:49Z")
hello following the recomendations that you kindlyme posted
I changed logstash version to 9.0.3, that is supported in RH9 according to support matrix.
[root@rh9v logstash]# logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 9.0.3
[root@rh9v logstash]#
but still has the same problem
SHELL=/bin/bash
SUDO\_GID=1000
HOSTNAME=rh9v.lab
HISTSIZE=1000
JAVA\_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
SUDO\_COMMAND=/bin/bash
SUDO\_USER=admin
PWD=/usr/share/logstash
LOGNAME=root
MODULESHOME=/usr/share/Modules
MANPATH=/usr/share/man:
LS\_H0ME=/usr/share/logstash
LOGSTASH\_CORE=/usr/share/logstash/logstash-core
[root@rh9v logstash]# logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[FATAL] 2025-07-05 21:46:05.890 [main] runner - An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/runner.rb:430:in `running_as_superuser'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:259:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:66:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:249:in `run'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:140:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:89:in `'"]}
[FATAL] 2025-07-05 21:46:05.902 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[root@rh9v logstash]#
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 6, 2025, 4:03am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/8 "2025-07-06T04:03:26Z")
> [@Luis\_Moy](#):
>
> [FATAL] 2025-07-05 21:46:05.890 [main] runner - An unexpected error occurred! {:error=\>#\,
Is that not clear? Running logstash as root is a terrible idea, so the latest version tries to stop you doing it.
If you really want to run as root then you can disable the check. The [release notes](https://www.elastic.co/guide/en/elastic-stack/9.0/release-notes-logstash-9.0.0.html#allow-superuser) mention it.
In logstash.yml for 9.x you should find
```auto
# Allow or block running Logstash as superuser (default: true)
# allow_superuser: false
```
Note that the comment (default: true) is simply wrong. The default in V9.0 is false, as implemented in PR 16558.
---
### Author:  [@Luis\_Moy](https://discuss.elastic.co/u/Luis_Moy)
#### Post date: [July 6, 2025, 6:16am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/9 "2025-07-06T06:16:12Z")
I tried to run with a normal user
with this settings
export LS\_HOME=/usr/share/logstash
export LOGSTASH\_CORE=/usr/share/logstash/logstash-core
export PATH=$PATH:$LS\_HOME/bin
export GEM\_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export GEM\_PATH=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export MY\_RUBY\_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0
export PATH=$PATH:/usr/share/logstash/vendor/jruby/bin
export JAVA\_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
export PATH=$PATH:$JAVA\_HOME/bin
[admin@rh9v ~]$ logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN] 2025-07-06 00:11:07.577 [main] runner - The use of JAVA\_HOME has been deprecated. Logstash 8.0 and later ignores JAVA\_HOME and uses the bundled JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK (organizational-specific compliance requirements, for example), you can configure LS\_JAVA\_HOME to use that version instead.
[INFO] 2025-07-06 00:11:07.585 [main] runner - Starting Logstash {"logstash.version"=\>"9.0.3", "jruby.version"=\>"jruby 9.4.9.0 (3.1.4) 2024-11-04 547c6b150e OpenJDK 64-Bit Server VM 21.0.7+6-LTS on 21.0.7+6-LTS +indy +jit [x86\_64-linux]"}
[INFO] 2025-07-06 00:11:07.589 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11]
[INFO] 2025-07-06 00:11:07.814 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-string-length` configured to `200000000` (logstash default)
[INFO] 2025-07-06 00:11:07.815 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-number-length` configured to `10000` (logstash default)
[INFO] 2025-07-06 00:11:07.816 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-nesting-depth` configured to `1000` (logstash default)
Your settings are invalid. Reason: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.
[FATAL] 2025-07-06 00:11:07.836 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[admin@rh9v ~]$
Then changed /etc/logstash/logstash.yml
# ------------ Other Settings --------------
#
# Allow or block running Logstash as superuser (default: true). Windows are excluded from the checking
**allow\_superuser: false**
#
# Where to find custom plugins
# path.plugins:
and run as root using the env.sh file
export LS\_HOME=/usr/share/logstash
export LOGSTASH\_CORE=/usr/share/logstash/logstash-core
export PATH=$PATH:$LS\_HOME/bin
export GEM\_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export GEM\_PATH=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export MY\_RUBY\_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0
export PATH=$PATH:/usr/share/logstash/vendor/jruby/bin
export JAVA\_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
export PATH=$PATH:$JAVA\_HOME/bin
[root@rh9v admin]# . ./env.sh
[root@rh9v admin]# logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[FATAL] 2025-07-06 00:14:50.317 [main] runner - An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/runner.rb:430:in `running_as_superuser'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:259:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:66:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:249:in `run'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:140:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:89:in `'"]}
[FATAL] 2025-07-06 00:14:50.330 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[root@rh9v admin]#
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 6, 2025, 10:28am UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/10 "2025-07-06T10:28:14Z")
> [@Luis\_Moy](#):
>
> Your settings are invalid. Reason: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.
You should change ownership:
`chown -R logstash:logstash /usr/share/logstash/data`
Run LS as a service.Normally, data should be in [/var/lib/logstash](https://www.elastic.co/docs/reference/logstash/dir-layout)
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [July 6, 2025, 1:11pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/11 "2025-07-06T13:11:02Z")
Logstash will be installed as a service if installed correctly from rpm on RHEL9, it would also create a logstash user to run as.
> [@Luis\_Moy](#):
>
> JAVA\_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
Any specific reason you are using that JDK rather than the JVM shipped with logstash ?
But your last post was difficult to read/parse due to formatting, but you seemed to again repeat error of running as root.
Here's my RHEL10 system, but RHEL9 is the same:
```auto
[kevin@rhel10x1 ~]$ systemctl status logstash | cat
● logstash.service - logstash
Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: disabled)
Active: active (running) since Sun 2025-07-06 13:08:05 UTC; 6s ago
Invocation: 7b50130cd88d47059eac6167d7fb3ea6
Main PID: 90914 (java)
Tasks: 21 (limit: 16412)
Memory: 333.5M (peak: 334.9M)
CPU: 11.226s
CGroup: /system.slice/logstash.service
└─90914 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Dlog4j2.isThreadContextMapInheritable=true -Djruby.regexp.interruptible=true -Djdk.io.File.enableADS=true --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio.channels=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/sun.management=ALL-UNNAMED -Dio.netty.allocator.maxOrder=11 -cp /usr/share/logstash/vendor/jruby/lib/jruby.jar:/usr/share/logstash/logstash-core/lib/jars/checker-qual-3.42.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.17.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-logging-1.3.1.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.26.1.jar:/usr/share/logstash/logstash-core/lib/jars/failureaccess-1.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.22.0.jar:/usr/share/logstash/logstash-core/lib/jars/guava-33.1.0-jre.jar:/usr/share/logstash/logstash-core/lib/jars/httpclient-4.5.14.jar:/usr/share/logstash/logstash-core/lib/jars/httpcore-4.4.16.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/javassist-3.30.2-GA.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-3.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/jvm-options-parser-9.0.3.jar:/usr/share/logstash/logstash-core/lib/jars/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-jcl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/reflections-0.10.2.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.32.jar:/usr/share/logstash/logstash-core/lib/jars/snakeyaml-2.2.jar org.logstash.Logstash --path.settings /etc/logstash
Jul 06 13:08:05 rhel10x1 systemd[1]: Started logstash.service - logstash.
Jul 06 13:08:05 rhel10x1 logstash[90914]: Using bundled JDK: /usr/share/logstash/jdk
[kevin@rhel10x1 ~]$ ps -ulogstash
PID TTY TIME CMD
90914 ? 00:00:25 java
```
---
### Author:  [@Luis\_Moy](https://discuss.elastic.co/u/Luis_Moy)
#### Post date: [July 6, 2025, 7:29pm UTC](https://discuss.elastic.co/t/new-logstash-installation-is-not-working/379824/12 "2025-07-06T19:29:50Z")
Hi, I reviewed the JDK of the logstash 9.0 and found that uses temurin JDK 21. Because i has many javas java --version still pointed to java 11. So i downloaded and installed temurin JDK 21, and launched with a user after give some permissions to directories.
Tested first on RH9, but still found problems so i decided to install and test with RH 8 and finally worked.
Thanks for all your help and suggestions
[admin@rh8v java]$ logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout { } }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN] 2025-07-06 13:28:02.278 [main] runner - The use of JAVA\_HOME has been deprecated. Logstash 8.0 and later ignores JAVA\_HOME and uses the bundled JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK (organizational-specific compliance requirements, for example), you can configure LS\_JAVA\_HOME to use that version instead.
[INFO] 2025-07-06 13:28:02.285 [main] runner - Starting Logstash {"logstash.version"=\>"9.0.3", "jruby.version"=\>"jruby 9.4.9.0 (3.1.4) 2024-11-04 547c6b150e OpenJDK 64-Bit Server VM 21.0.7+6-LTS on 21.0.7+6-LTS +indy +jit [x86\_64-linux]"}
[INFO] 2025-07-06 13:28:02.289 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11]
[INFO] 2025-07-06 13:28:02.518 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-string-length` configured to `200000000` (logstash default)
[INFO] 2025-07-06 13:28:02.519 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-number-length` configured to `10000` (logstash default)
[INFO] 2025-07-06 13:28:02.519 [main] StreamReadConstraintsUtil - Jackson default value override `logstash.jackson.stream-read-constraints.max-nesting-depth` configured to `1000` (logstash default)
[WARN] 2025-07-06 13:28:02.767 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because command line options are specified
[INFO] 2025-07-06 13:28:03.662 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600, :ssl\_enabled=\>false}
[INFO] 2025-07-06 13:28:03.840 [Converge PipelineAction::Create] Reflections - Reflections took 161 ms to scan 1 urls, producing 149 keys and 521 values
[INFO] 2025-07-06 13:28:04.113 [Converge PipelineAction::Create] javapipeline - Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise.
[INFO] 2025-07-06 13:28:04.168 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, "pipeline.sources"=\>["config string"], :thread=\>"#\"}
[INFO] 2025-07-06 13:28:04.976 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=\>0.81}
[INFO] 2025-07-06 13:28:05.016 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"}
The stdin plugin is now waiting for input:
[INFO] 2025-07-06 13:28:05.037 [Agent thread] agent - Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
hello world
{
"message" =\> "hello world",
"@version" =\> "1",
"@timestamp" =\> 2025-07-06T19:28:41.781834673Z,
"event" =\> {
"original" =\> "hello world"
},
"host" =\> {
"hostname" =\> "rh8v.lab"
}
}